{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-31T16:34:59.424911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T22:08:12.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "C-More EA9",
          "vendor": "AutomationDirect",
          "versions": [
            {
              "status": "affected",
              "version": "6.78"
            }
          ]
        }
      ],
      "dateAssigned": "2024-11-21T20:33:22.222Z",
      "datePublic": "2024-12-11T19:33:21.842Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AutomationDirect C-More EA9. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EAP9 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24772."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T20:18:26.773Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-1673",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1673/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://certvde.com/en/bulletins/bulletins/2182-automationdirect-c-more-ea9-programming-software/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Andrea Micalizzi aka rgod (@rgod777)"
      },
      "title": "AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-11609",
    "datePublished": "2025-01-30T20:18:26.773Z",
    "dateReserved": "2024-11-21T20:33:22.147Z",
    "dateUpdated": "2025-02-10T22:08:12.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-31T16:34:45.664663Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T22:08:05.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "C-More EA9",
          "vendor": "AutomationDirect",
          "versions": [
            {
              "status": "affected",
              "version": "6.78"
            }
          ]
        }
      ],
      "dateAssigned": "2024-11-21T20:33:27.022Z",
      "datePublic": "2024-12-11T19:33:26.467Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AutomationDirect C-More EA9. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EAP9 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24773."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T20:18:47.291Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-1674",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1674/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://certvde.com/en/bulletins/bulletins/2182-automationdirect-c-more-ea9-programming-software/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Andrea Micalizzi aka rgod (@rgod777)"
      },
      "title": "AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-11610",
    "datePublished": "2025-01-30T20:18:47.291Z",
    "dateReserved": "2024-11-21T20:33:26.969Z",
    "dateUpdated": "2025-02-10T22:08:05.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.035Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T17:27:48.143452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:49:35.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "C-more EA9",
          "vendor": "AutomationDirect",
          "versions": [
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T6CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T6CL-R",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T7CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T7CL-R",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T8CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T10CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T10WCL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T12CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T15CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-RHMI",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-PGMSW",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sam Hanson of Dragos reported this vulnerability to CISA."
        }
      ],
      "datePublic": "2022-06-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-31T15:33:03.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "AutomationDirect recommends users upgrade to firmware Version 6.73 or later, which supports TLS security options for the webserver.\n\nWhile automation networks and systems have built-in password protection schemes, this is only one step in securing the affected systems. Automation control system networks must incorporate data protection and security measures at least as robust as a typical business computer system. AutomationDirect recommends users of PLCs, HMI products, and other SCADA system products perform independent network security analysis to determine the proper level of security required for the application.\n\nAutomationDirect has identified the following mitigations for instances where systems cannot be upgraded to Version 6.73 or later:\n\nThe Webserver feature can be disabled on the HMI using the programming software.\nPlace the HMI panel behind a VPN: Access to and from critical control system assets in the modern environment is usually LAN based, but still should be considered remote if the operator is traversing across different networks. virtual private networking (VPN) is often considered the best approach in securing trans-network communication."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2022-06-16T17:00:00.000Z",
          "ID": "CVE-2022-2006",
          "STATE": "PUBLIC",
          "TITLE": "AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "C-more EA9",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T6CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T6CL-R",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T7CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T7CL-R",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T8CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T10CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T10WCL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T12CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T15CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-RHMI",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-PGMSW",
                            "version_value": "6.73"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "AutomationDirect"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Sam Hanson of Dragos reported this vulnerability to CISA."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-427 Uncontrolled Search Path Element"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01",
              "refsource": "CONFIRM",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "AutomationDirect recommends users upgrade to firmware Version 6.73 or later, which supports TLS security options for the webserver.\n\nWhile automation networks and systems have built-in password protection schemes, this is only one step in securing the affected systems. Automation control system networks must incorporate data protection and security measures at least as robust as a typical business computer system. AutomationDirect recommends users of PLCs, HMI products, and other SCADA system products perform independent network security analysis to determine the proper level of security required for the application.\n\nAutomationDirect has identified the following mitigations for instances where systems cannot be upgraded to Version 6.73 or later:\n\nThe Webserver feature can be disabled on the HMI using the programming software.\nPlace the HMI panel behind a VPN: Access to and from critical control system assets in the modern environment is usually LAN based, but still should be considered remote if the operator is traversing across different networks. virtual private networking (VPN) is often considered the best approach in securing trans-network communication."
          }
        ],
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-2006",
    "datePublished": "2022-08-31T15:33:03.440Z",
    "dateReserved": "2022-06-06T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:49:35.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11611",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T20:42:37.203630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-06T21:25:24.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "C-More EA9",
          "vendor": "AutomationDirect",
          "versions": [
            {
              "status": "affected",
              "version": "6.78"
            }
          ]
        }
      ],
      "dateAssigned": "2024-11-21T20:33:31.540Z",
      "datePublic": "2024-12-11T19:33:32.159Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AutomationDirect C-More EA9. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EAP9 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24774."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T20:18:56.716Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-1675",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1675/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://certvde.com/en/bulletins/bulletins/2182-automationdirect-c-more-ea9-programming-software/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Andrea Micalizzi aka rgod (@rgod777)"
      },
      "title": "AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-11611",
    "datePublished": "2025-01-30T20:18:56.716Z",
    "dateReserved": "2024-11-21T20:33:31.495Z",
    "dateUpdated": "2025-02-06T21:25:24.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:43.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:54:38.875988Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T16:11:43.495Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "C-more EA9",
          "vendor": "AutomationDirect",
          "versions": [
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T6CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T6CL-R",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T7CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T7CL-R",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T8CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T10CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T10WCL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T12CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-T15CL",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-RHMI",
              "versionType": "custom"
            },
            {
              "lessThan": "6.73",
              "status": "affected",
              "version": "EA9-PGMSW",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sam Hanson of Dragos reported this vulnerability to CISA."
        }
      ],
      "datePublic": "2022-06-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-31T15:33:03.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "AutomationDirect recommends users upgrade to firmware Version 6.73 or later, which supports TLS security options for the webserver.\n\nWhile automation networks and systems have built-in password protection schemes, this is only one step in securing the affected systems. Automation control system networks must incorporate data protection and security measures at least as robust as a typical business computer system. AutomationDirect recommends users of PLCs, HMI products, and other SCADA system products perform independent network security analysis to determine the proper level of security required for the application.\n\nAutomationDirect has identified the following mitigations for instances where systems cannot be upgraded to Version 6.73 or later:\n\nThe Webserver feature can be disabled on the HMI using the programming software.\nPlace the HMI panel behind a VPN: Access to and from critical control system assets in the modern environment is usually LAN based, but still should be considered remote if the operator is traversing across different networks. virtual private networking (VPN) is often considered the best approach in securing trans-network communication."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AutomationDirect C-more EA9 HMI Cleartext Transmission",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2022-06-16T17:00:00.000Z",
          "ID": "CVE-2022-2005",
          "STATE": "PUBLIC",
          "TITLE": "AutomationDirect C-more EA9 HMI Cleartext Transmission"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "C-more EA9",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T6CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T6CL-R",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T7CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T7CL-R",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T8CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T10CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T10WCL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T12CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-T15CL",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-RHMI",
                            "version_value": "6.73"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "EA9-PGMSW",
                            "version_value": "6.73"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "AutomationDirect"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Sam Hanson of Dragos reported this vulnerability to CISA."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-319 Cleartext Transmission of Sensitive Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01",
              "refsource": "CONFIRM",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "AutomationDirect recommends users upgrade to firmware Version 6.73 or later, which supports TLS security options for the webserver.\n\nWhile automation networks and systems have built-in password protection schemes, this is only one step in securing the affected systems. Automation control system networks must incorporate data protection and security measures at least as robust as a typical business computer system. AutomationDirect recommends users of PLCs, HMI products, and other SCADA system products perform independent network security analysis to determine the proper level of security required for the application.\n\nAutomationDirect has identified the following mitigations for instances where systems cannot be upgraded to Version 6.73 or later:\n\nThe Webserver feature can be disabled on the HMI using the programming software.\nPlace the HMI panel behind a VPN: Access to and from critical control system assets in the modern environment is usually LAN based, but still should be considered remote if the operator is traversing across different networks. virtual private networking (VPN) is often considered the best approach in securing trans-network communication."
          }
        ],
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-2005",
    "datePublished": "2022-08-31T15:33:03.273Z",
    "dateReserved": "2022-06-06T00:00:00.000Z",
    "dateUpdated": "2025-04-16T16:11:43.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}